CVE-2026-64878: Command Injection
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tenable Security Centerto a version that resolves this vulnerability.Patch SC202607.1 - Compensating control
Restrict network access to the Security Center Analysis REST endpoint to trusted users/sources until SC202607.1 is applied.
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
An attacker needs low-level privileges to access the Analysis REST endpoint. No user interaction is required.
What is the impact of successful exploitation?
Successful exploitation can result in remote code execution with the privileges of a low-privileged operating system user. The reported impact includes compromise of confidentiality, integrity, and availability.